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IN THE CLAIMS: 

The text of all pending claims, (including withdrawn claims) is set forth below. Canceled 
and not entered claims are indicated with claim number and status only. The claims as listed 
below show added text with underlining and deleted text with str i kothrough . The status of each 
claim is indicated with one of (original), (currently amended), (canceled), (withdrawn), (new), 
(previously presented), or (not entered). 

Please CANCEL claims 15-26 and AMEND claims 1, 3-5, 8-11 and 27-29 in accordance 
with the following: 

1 . (Currently Amended) A method for computer-aided monitoring of a 
telecommunication network formed of devices capable of communication, said method 
comprising: 

determining training activity parameters, each describing activity of at least one of a 
corresponding device and a corresponding service; 

determining possible dependences between devices and services from the training 
activity parameters: 

determining from the possible dependences a normal range of dependence for at least 
some of the devices and services in essentially undisturbed states to train a statistical estimator: 

determining current activity parameters, each describing activity of at least one of a 
corresponding device and a corresponding service: 

comparing the current activity parameters by a-the statistical estimator with the trained 
w i th tra i n i ng data and having a normal range of dependence bas e d on d e p e nd e nc e s d e t e rmined 
b e tw ee n th e d e v i ces ; and 

determining from said comparing whether at least one of the devices and services in the 
telecommunication network has a communication performance different from the normal range 
of dependence in accordance with a predetermined criterion. 

2. (Original) The method as claimed in claim 1, wherein at least some of the devices are 
constructed as terminals capable of communication. 

3. (Currently Amended) The method as claimed in claim 1, wherein the training activity 
parameters are determined within a predetermined time interval. 
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4. (Currently Amended) The method as claimed in claim 1 , 

wherein said determining of each training activity parameter is performed by the 
corresponding device, and 

wherein said method further comprises transmitting the training activity parameters to an 
administration unit which performs said comparing and determining based on said comparing. 

5. (Currently Amended) The method as claimed in claim 1, wherein said determining of 
each training activity parameter is performed by af ha training activity parameter determining unit 
separate from the corresponding device[[s]]. 

6. (Original) The method as claimed in claim 1, further comprising determining 
communication-dependent dependences between at least some of the devices and services. 

7. (Original) The method as claimed in claim 1, further comprising determining possible 
directional dependences with regard to directions of communication between at least some of 
the devices and services. 

8. (Currently Amended) The method as claimed in claim 1, 

further comprising determining data of at least some of the devices and services, and 
wherein said determining of the training activity parameters is based on the data. 

9. (Currently Amended) The method as claimed in claim 1, wherein said determining of 
the training activity parameters uses all possible pairs of the devices and pairs of services. 

10. (Currently Amended) The method as claimed in claim 9, further comprising: 
storing the training activity parameters determined from the pairs of devices in a matrix; 

and 

determining the normal range of dependence from a structure of the matrix. 

11. (Currently Amended) The method as claimed in claim 1, wherein at least one of the 
following parameters is determined as one of the training activity parameters 

data packets sent or received by the at least one of a corresponding device and a 
corresponding service, 

processor utilization of the corresponding device, 
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a number of predetermined system function calls, and 

existence of at least one of predetermined processes and predetermined computer 
programs. 

12. (Original) The method as claimed in claim 1, wherein a neuro-fuzzy model is used 
as the statistical estimator. 

13. (Original) The method as claimed in claim 1, further comprising generating an alarm 
signal when at least one device in the telecommunication network differs from the normal range 
of dependence in accordance with the predetermined criterion. 

14. (Original) The method as claimed in claim 1, further comprising at least one of 
determining a disturbance of one of the devices in the telecommunication network; 
determining an unauthorized attempt to access one of the devices; and 
determining an unauthorized access attempt by one of the devices. 

Claims 15-26 (Canceled). 

27. (Currently Amended) A device for computer-aided monitoring of a telecommunica- 
tion network formed of devices capable of communication, comprising: 

at least one processor to determine training activity parameters, each describing activity 
of at least one of a corresponding device and a corresponding service, to determine possible 
dependences between devices and services from the training activity parameters, to determine 
from the possible dependences a normal range of dependence for at least some of the devices 
and services in essentially undisturbed states to train a statistical estimator to determine current 
activity parameters, each describing activity of at least one of a corresponding device and a cor - 
responding service, to compare the current activity parameters by a-the statistical estimator with 
the tra i n e d w i th tra i n i ng data and having a normal range of dependence bas e d on d e p e nd e nc e s 
d e t e rm i n e d b e tw ee n th e d e v i c e s , and to determine from said comparing whether at least one of 
the devices and services in the telecommunication network has a communication performance 
different from the normal range of dependence in accordance with a predetermined criterion. 

28. (Currently Amended) At least one computer-readable storage medium storing at 
least one computer program for computer-aided monitoring of a telecommunication network 
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formed of devices capable of communication, to control a processor to perform a method 
comprising: 

determining training activity parameters, each describing activity of at least one of a 
corresponding device and a corresponding service; 

determining possible dependences between devices and services from the training 
activity parameters; 

determining from the possible dependences a normal range of dependence for at least 
some of the devices and services in essentially undisturbed states to train a statistical estimator; 

determining current activity parameters, each describing activity of at least one of a 
corresponding device and a corresponding service; 

comparing the current activity parameters by a -the statistical estimator with the t rained 
with tra i n i ng data and hav i ng a normal range of dependence bas e d on depend e nc e s det e rm i n e d 
b e tw ee n th e d e v i c e s ; and 

determining from said comparing whether at least one of the devices and services in the 
telecommunication network has a communication performance different from the normal range 
of dependence in accordance with a predetermined criterion. 

292S. (Currently Amended) At least one computer-readable storage medium storing at 
least one computer program for computer-aided training of a statistical estimator for admini- 
stering a telecommunication network formed of devices capable of communication, to control a 
processor to perform a method comprising: 

determining training activity parameters, each describing activity of at least one of a 
corresponding device and a corresponding service; 

determining possible dependences between the devices and services from the training 
activity parameters;-a«d 

determining from the possible dependences a normal range of dependence for at least 
some of the devices and services in essentially undisturbed states to train the statistical estima- 
to r for determining current activity parameters, each describing activity of at least one of a cor - 
responding device and a corresponding service and comparing the current activity parameters 
with the normal range of dependence . 
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